security metrics

The Center for Internet Security has released eight security metrics companies can use to measure their security programs and it plans to expand its list over the next year.

Mozilla is working to develop metrics to measure the security of Firefox. The company has partnered with security researcher Rich Mogull on the project.“We are trying to develop a model that goes beyond simple bug counts and more accurately reflects both the effectiveness of secure development efforts, and the relative risk to users over time,” [...]  read more »

Accurate security metrics can be tough to come by, but IT shops can't afford not to try, says security pioneer Dan Geer. Geer also measures Kerberos against today's threats.